You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2020/09/03 19:11:07 UTC
[GitHub] [incubator-superset] kelly-grizzle-sp opened a new issue #10785: Remote code execution via jinja2 template injection
kelly-grizzle-sp opened a new issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785
Commands can be run on the operating system of the server hosting superset by using the "uuid" module that is made available to jinja2 templates.
#### Screenshots
<img width="1241" alt="Screen Shot 2020-09-03 at 2 08 56 PM" src="https://user-images.githubusercontent.com/5994971/92156844-2c096000-edef-11ea-9841-b7b97356eb3e.png">
<img width="1665" alt="Screen Shot 2020-09-03 at 2 09 31 PM" src="https://user-images.githubusercontent.com/5994971/92156863-34fa3180-edef-11ea-8fb1-d6a02f3b225f.png">
#### How to reproduce the bug
1. Go to Charts
2. Click on the plus sign to create a new chart.
3. Choose any datasource and use the "Table" viz type.
4. Select any field in the "Filters" field.
5. Click the "Custom SQL" tab.
6. After the equals sign, add the following (including the quotes): '{{ uuid.os.popen('ls -A').read()}}'
7. Click Save to save the custom SQL.
8. Click the "Run Query" button.
9. Click the "View Query" menu item from the hamburger menu at the top right of the chart.
10. You will see the results of running the `ls` command on the file system in the query. Note: this command is non-destructive but a user could issue any command that is available in the PATH of the underlying OS.
### Environment
- superset version: Superset 0.999.0dev (70c676478080bb0daec8cd0768cf7d01cdd309ea)
- python version: Python 3.7.3
- node.js version: v10.15.1
- npm version: 6.4.1
### Checklist
Make sure these boxes are checked before submitting your issue - thank you!
- [X] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [X] I have reproduced the issue with at least the latest released version of superset.
- [X] I have checked the issue tracker for the same issue and I haven't found one similar.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] dpgaspar commented on issue #10785: Remote code execution via jinja2 template injection
Posted by GitBox <gi...@apache.org>.
dpgaspar commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687141139
Hi kelly-grizzle-sp thank you for reporting this. Will try to replicate and find a solution for this
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] dpgaspar edited a comment on issue #10785: Remote code execution via jinja2 template injection
Posted by GitBox <gi...@apache.org>.
dpgaspar edited a comment on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687141139
Hi @kelly-grizzle-sp thank you for reporting this. Will try to replicate and find a solution for this
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] kelly-grizzle-sp commented on issue #10785: REDACTED by @willbarrett
Posted by GitBox <gi...@apache.org>.
kelly-grizzle-sp commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687250257
Sorry about that. I am new to collaborating with the superset team and did not know the appropriate channels to go through.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] willbarrett commented on issue #10785: REDACTED by @willbarrett
Posted by GitBox <gi...@apache.org>.
willbarrett commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687251062
It's OK @kelly-grizzle-sp - we're glad we know, we're glad you told us, but it's better if these reports aren't in public.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] issue-label-bot[bot] commented on issue #10785: Remote code execution via jinja2 template injection
Posted by GitBox <gi...@apache.org>.
issue-label-bot[bot] commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-686702319
Issue-Label Bot is automatically applying the label `#enhancement` to this issue, with a confidence of 0.59. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: [app homepage](https://github.com/marketplace/issue-label-bot), [dashboard](https://mlbot.net/data/apache/incubator-superset) and [code](https://github.com/hamelsmu/MLapp) for this bot.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] mistercrunch commented on issue #10785: Remote code execution via jinja2 template injection
Posted by GitBox <gi...@apache.org>.
mistercrunch commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687234166
In the future, please report vulnerabilities privately using `private@superset.apache.org`, so that we can publish a patch prior to divulging the vulnerability.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] robdiciuccio commented on issue #10785: Remote code execution via jinja2 template injection
Posted by GitBox <gi...@apache.org>.
robdiciuccio commented on issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785#issuecomment-687241261
Thanks for reporting. Please follow vulnerability reporting procedure in the link below and delete this issue until a fix is verified and included in an official release: https://www.apache.org/security/committers.html
We’ll update the docs with clearer information on reporting security issues.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] willbarrett closed issue #10785: REDACTED by @willbarrett
Posted by GitBox <gi...@apache.org>.
willbarrett closed issue #10785:
URL: https://github.com/apache/incubator-superset/issues/10785
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org